Toggle sidebar

Hacking Dumping Wii U NAND via SD card adapter

  • Thread starter Thread starter pelago
  • Start date Start date
  • Views Views 20,578
  • Replies Replies 61
  • Likes Likes 1
P

pelago

Member
Member
Level 5
Joined
Feb 20, 2006
Messages
1,019
Reaction score
57
Trophies
2
XP
614
Country
  • Like
Reactions: jammybudga777
pelago said:
Is it possible to dump the Wii U NAND (not the vWii NAND) using a soldered SD card adapter, just as is possible on 3DS? See http://gbatemp.net/threads/nand-flash-dump-3ds-xl.350668/ and http://gbatemp.net/threads/nand-flash-dump-3ds.353263/

I realise that there's no hack for the Wii U yet, but I still like the idea of backing up the current firmware now so that the console could later be downgraded, just in case.
Click to expand...



definatly an interesting theory. would be interesting to find out
 
pelago said:
Is it possible to dump the Wii U NAND (not the vWii NAND) using a soldered SD card adapter, just as is possible on 3DS? See http://gbatemp.net/threads/nand-flash-dump-3ds-xl.350668/ and http://gbatemp.net/threads/nand-flash-dump-3ds.353263/

I realise that there's no hack for the Wii U yet, but I still like the idea of backing up the current firmware now so that the console could later be downgraded, just in case.
Click to expand...
I've started a thread with more links and nobody cared. Maybe because it is somebody else this may get attention. Don't hold your breath though;-)
 
  • Like
Reactions: migles
It does use emmc. My thread had many links and diagrams. No tri wing screwdriver so I wanted to see if people had or would try it...like the 3ds.
 
  • Like
Reactions: migles
  • Like
Reactions: pelago, cearp and migles
cory1492 said:
ahaha... if Ray's profile wasn't private and I had signatures turned on (or the inclination to turn them back on and make this place look more Akhibara street sign again)

I believe this is the link this thread is discussing... if not someone who can see the sigs will surely correct me
http://gbatemp.net/threads/wii-u-emmc-nand-read-write-read-before-flaming.355678/
Click to expand...
Yes, that is the one. I referenced this in the current Wii U hacking threads. As you can see there are links with a lot of information. I don't have the ability to open my Wii U and don't want to brick so I hoped knowledgeable people would try and comment. Maybe they could offer a guide? Nobody was interested at the time I made that thread and perhaps it is relevant now. Revert to beat Nintendo and go back to a vulnerable firmware and recover if more involved methods of exploring are utilized. Comex bricked without modifying anything!!!! Edit; ts, please add the links from my old thread here.
 
What is the part number on the Wii U Nand? anyone know it off hand. I have a ton of chip programmers, and if needed i can probably build one to read from the nand.. just need to know where to start messin.
 
If I have read correctly, you need to read 2 NANDs. Both the one in orange here:
gqSDvioKMCE2DKCr.huge

...and the one in black here:
SUlQwYVPDtCY6ppv.huge

Pics taken from ifixit.
 
Samsung KLM8G2FE3B eMMC 8 GB NAND Flash/Memory Controller (8GB and 32GB flavors)
and
Samsung K9K8G08U1D 4 Gb (512 MB) NAND Flash

i see five resistors and a cap on the top side near nand. possibly JTAG point, 1cap and 5 resistors. See some similar spots on back near the other nand. One has to be SYSTEM, and the other is probably storage. The K9K part has leads on it, and in most designs that would be what holds the system operating flash code.

Same chips were used in Samsung Galaxy Tab 2 7.0 , and reflashing and reading / writing has already been accomplished. Looks like i can only find a few pieces of hardware for sale to dump them, but it is done via JTAG, so if the points can be found for proper JTAG connection it should be easy (easy enough).

Would be nice to be able to use the PPC to dump all of it.


Has anyone done any probing? found any serial communication / uart ports?
 
  • Like
Reactions: pelago
And without measuring looks like the 2 nands are almost on top of each other on opposite side of PCB. Wonder if they use same lines/connections and there is pass through, maybe a space saving technique? Wish I had an XRAY




So before i get totally loaded for bear, and piss money into the wind. Anyone else want to (and able) to work on this approach together?
 
How to find the JTAG port? I am thinking since the data lines [7-0] all have 50Kohm res on them, the JTAG lines would probably have 100 to 330 Ohm res on them close to the nand as possible.


*Note: Just probing with a meter can be misleading, resistors and capacitors in circuit will measure different, maybe, if they are in parallel or series. And there is also "in circuit" cap and res to consider.



* should I start a new thread for this? realize i am kinda hijacking a thread on dumping to an SD Card..?
 
Well it could be possible, I prefer wait to homebrew NAND dump, because that could be risky and you need a 32GB or 64GB SD Card to dump all the NAND of Wii U (the basic owners have only 8GB so it's easier), if we have a Wii U NAND Dumper, I hope it bring USB support to dumping the 32GB NAND because I don't have a very big SD card...
 

Site & Scene News

Go to forum More news

Popular threads in this forum

Hardware Homebrew  Is there really no new way to play with an ngc controller and adapter via vWii?

Can Wii U play Wii games in 1080P yet?

Homebrew Tutorial  miigrate: Recover and move Wii U & vWii savedata and Miis to a new console

WiiU SDKs

Trying to get Neek to work [vWii]

Hacking  vWii — every title hangs on black screen when launched normally through the Wii Menu (fully stock, freshly restored)

What can I do to restore my Wii U

Wii U Disc update